4 Commits

Author	SHA1	Message	Date
mteehan	358573567d	fix: dual-key rate limiting for auth + websocket reconnect guard ... - Pass client IP (X-Real-IP header) through Flask to daemon for both password login and WebAuthn authenticate-finish endpoints - Rate limiter now checks both IP and username buckets: IP layer catches enumeration/brute-force attacks across multiple usernames; username layer protects against single-account targeting from multiple IPs - Add _wsRefreshing flag to prevent double-scheduling reconnect when onclose fires during token refresh; simplify async IIFE to .then()/.catch() - Reset _wsRefreshing on websocket onopen for safety	2026-07-28 00:54:48 +00:00
mteehan	ca110c321d	style: format docs, fix user_permissions variable scoping in auth middleware ... Apply ruff line-wrapping formatting to docs and test files. Clarify auth middleware: extract user_permissions once before subsystem check, removing conditional variable scoping.	2026-07-27 18:37:11 +00:00
mteehan	a365059976	security: harden JWT auth with session binding, CSP headers, and sessionStorage ... - Reduce access_token_ttl from 900s to 300s (5 min) to shrink XSS exploit window - Add session_id claim to JWT tokens tied to browser session (X-Session-Id header) - Flask middleware validates session_id matches header on every request - CSP headers: default-src/script-src 'self', no unsafe-inline/eval, frame-ancestors none - X-Content-Type-Options: nosniff on all responses - Move refresh token from localStorage to sessionStorage (tab-scoped, cleared on close) - Timing-safe password verification (dummy Argon2id for unknown users) - WebSocket auth also validates session_id header - Add 5 session_id tests and 3 CSP header tests	2026-07-24 03:09:07 +00:00
mteehan	56b200d233	feat: add auth subsystem with WebAuthn passkeys support ... New modules: lib/auth, lib/auth_users, lib/db, lib/db_sqlite, lib/password, lib/webauthn, daemon/handlers/auth, scripts/bootstrap_auth, tests/test_auth Frontend: webui/api/auth, hoover/components/auth, pages/login, passkeys, users Updates: daemon/iface and server, lib/common and nginx, pyproject.toml deps, install script, server.py, app.js, and websocket/api clients	2026-07-24 01:21:39 +00:00